{"id":"6f3d2a8b-0087-42fb-a813-64441f4d2732","arxiv_id":"2501.12723","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Data collaboration analysis trains an autoencoder anomaly detector across organizations in one communication round and outperforms FedAvg and FedProx on journal entry data under non-i.i.d. conditions.","lead":"The authors built an anomaly detection system that lets audit organizations train a shared model on journal entry data without sharing raw records, using data collaboration analysis instead of model-sharing federated learning. The method needs only one communication round and beat FedAvg and FedProx on real multi-organization data, especially in heterogeneous non-i.i.d. settings.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy claim is internally breakable: the analyst can recover the PCA map from shared anchor pairs and invert the m−1-dimensional projections, so the 'infeasible inference' assertion is false.","rationale":"The reader's CONDITIONAL verdict identifies the privacy claim as the weakest assumption; I agree and sharpen it to a concrete invertibility attack. This is the single most load-bearing concern because the paper's central value proposition—'does not require raw data to be exposed'—depends entirely on it. The concern is not merely that no formal privacy analysis exists; under the paper's own protocol, the analyst possesses enough information to reconstruct the PCA projection function and thereby approximately invert the shared representations. Specifically, in Section 4.2 Step 1, the analyst generates and distributes a public anchor matrix X_anc, then receives f_i(X_anc) from each client. Because f_i is PCA, it is an affine map x ↦ (x−μ_i)V_i, and the anchor pairs are exactly matched input-output examples. Solving a least-squares system recovers V_i whenever the anchor has full column rank, which holds with probability 1 for a continuous random anchor. With V_i known, each shared score is a one-parameter family; the discrete one-hot structure of journal entries resolves the remaining parameter. Thus the paper's assertion that an adversary would need f_i or matched raw/projected pairs is incorrect—the protocol hands the adversary matched pairs. The authors' own Conclusion admits the 'effectiveness of preventing raw data inference through PCA-based dimensionality reduction on sparse data warrants further investigation,' confirming the gap. A concrete computational test can settle the issue: simulate the protocol, recover V_i, invert the scores, and measure exact account-code recovery. If, as I expect, the recovery rate is high, the central claim collapses and the paper should be rejected or fundamentally revised. The performance comparison (DC vs. FedAvg/FedProx) may survive, but the framework's stated purpose of preserving confidentiality would be void.","tokens_in":17337,"tokens_out":8385,"duration_ms":82443,"concrete_test":"Implement the DC protocol on the real-style dataset (or the paper's synthetic data) with m features (one-hot plus amount). Let r = 2m and draw X_anc ~ Uniform(0,1) of size r×m. For one client, fit PCA with m−1 components on its training data, compute X̃_i and X̃_i^anc. Give the analyst only X_anc, X̃_i, and X̃_i^anc. Recover V_i by solving (X_anc | 1) B = X̃_i^anc in the least-squares sense. Then invert each row of X̃_i to the closest valid one-hot/amount vector, disambiguating the one-parameter family using the discrete debit/credit account constraints, and measure the fraction of journal entries exactly recovered (correct debit account, credit account, and amount within a small tolerance). If the recovery rate exceeds 90%, the privacy claim in Section 4.2 collapses.","verdict_should_be":"REJECT","load_bearing_attack":"In Section 4.2, Step 1, the authors assert that sharing only PCA-projected representations preserves confidentiality because the dimensionality-reduction function f_i is never shared and an adversary would need f_i or matched raw/projected pairs to invert the transform. This assertion is internally contradicted by the DC protocol itself: the analyst generates the anchor matrix X_anc, shares it with every organization, and receives back X̃_i^anc = f_i(X_anc). Since f_i is PCA, it is affine: f_i(x) = (x − μ_i)V_i, with V_i ∈ R^{m×(m−1)}. Treating rows of X_anc as features, the analyst has the linear system X̃_i^anc = X_anc V_i + 1(−μ_i^T V_i). If the anchor has at least m+1 rows and full column rank (true with probability 1 for a continuous random matrix), V_i and μ_i^T V_i are uniquely recoverable by least squares. With V_i known, every shared score row s satisfies x = μ_i + V_i s + t·v_m, a one-parameter family along the omitted last principal component. For one-hot encoded journal entries (debit/credit account indicators plus amount), this one-dimensional ambiguity is easily resolved by the discrete 0/1 account structure and valid account-pair constraints, yielding near-exact recovery of the original entries. Thus the central claim that 'raw data need not be exposed' is not merely unproven; it is likely false under the paper's own protocol. The authors themselves concede in the Conclusion that the effectiveness of preventing raw-data inference via PCA on sparse data 'warrants further investigation,' further confirming the gap.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a data collaboration (DC) analysis-based anomaly detection framework for double-entry bookkeeping data. Each organization applies its own PCA-based dimensionality reduction to its local journal entries and to a shared random anchor matrix, and shares only the resulting intermediate representations with an analyst. The analyst constructs a collaboration representation, trains an autoencoder on it, and returns the transformation and model to the organizations, so the whole process requires a single training round and (per the authors) no exposure of raw data and no connection of raw-data devices to external networks. The framework is evaluated on a synthetic dataset and on real multi-year journal entry data from eight Japanese healthcare organizations, under both i.i.d. and non-i.i.d. partitions, and compared against individual analysis (IA), centralized analysis (CA), FedAvg, and FedProx using average precision metrics. The reported results show that DC outperforms IA everywhere and outperforms FedAvg and FedProx under most non-i.i.d. conditions, especially on local anomalies at λ=4, while FedAvg is stronger in the i.i.d. real-data setting.","tokens_in":17652,"tokens_out":12267,"duration_ms":119496,"significance":"If the claims held, the framework would address a genuine operational constraint: accounting data are often kept in air-gapped environments, and model-sharing FL requires repeated connectivity. The paper has real strengths: it uses actual multi-organization journal entry data (a scarce resource), matches total training effort across baselines, repeats each experiment 10 times with standard deviations, uses both synthetic and real data, and directs the evaluation at the AP metrics that matter for auditing. The experimental comparison is mostly well constructed. However, the paper's headline confidentiality claim is asserted, not established, and the protocol as written appears to make the asserted privacy guarantee false under the paper's own assumptions. Because both the Abstract and the Introduction frame 'raw data need not be exposed' as a core advantage over model-sharing FL, this is load-bearing. The performance claims also need some tempering at λ=8, where several differences are within one standard deviation.","major_comments":[{"comment":"The confidentiality guarantee is unsupported and is internally contradicted by the protocol. The authors state that recovering the raw data would require access to f_i or to matched raw/projected pairs, and assert that inferring the original journal entries 'precisely from the shared representations would be infeasible' even if the analyst were an adversary. But in the very same protocol the analyst generates the anchor X_anc (Section 4.2, item 2; Algorithm line 1), shares it with every organization, and receives back X̃_i^anc = f_i(X_anc). Since f_i is PCA, it is affine: f_i(x) = (x − μ_i)V_i with V_i ∈ R^{m×(m−1)}, so X̃_i^anc = X_anc V_i − 1(μ_iᵀV_i). If X_anc has full column rank m (true with probability 1 for a continuous random matrix once r ≥ m; the paper does not specify or bound r), least squares recovers V_i and μ_iᵀV_i uniquely, i.e., the protocol hands the analyst exactly the matched raw/projected pairs whose absence the argument presupposes. Then every shared score row s yields candidate reconstructions x = V_i(s − b) + γn, with n spanning the omitted last principal component and only the scalar γ unknown. For one-hot encoded sparse journal entries, the 0/1 account structure and the valid debit-credit pair constraints resolve γ, giving near-exact recovery. The authors themselves concede in the Conclusion that the effectiveness of preventing raw-data inference via PCA on sparse data 'warrants further investigation,' so the unqualified guarantee in Section 4.2 and the Abstract's 'without exposing raw data' framing go beyond what is established. Please either provide a formal privacy analysis under an explicit adversary model (e.g., differential privacy with calibrated noise), or add a concrete reconstruction-attack evaluation that includes the anchor-based inversion described here, and weaken the claims to match the evidence.","section":"Section 4.2, Step 1; Algorithm; Conclusion"},{"comment":"The stated novelty 'the first application of DC analysis to unsupervised learning' is contradicted by the paper's own related-work section. Section 2.2 cites Imakura et al. (2021b) as having 'applied DC analysis to anomaly detection,' and novelty detection is an unsupervised learning task. Please rephrase the contribution claim (for example, as the first application of DC analysis to autoencoder-based anomaly detection on journal entry data) so that the novelty statement is accurate with respect to the cited literature.","section":"Section 1; Section 6"},{"comment":"The claim that DC 'consistently outperforms FedAvg and FedProx on APall and APlocal' in the non-i.i.d. setting is not supported at λ = 8. In Table 4, APall is 0.495 ± 0.035 for DC versus 0.491 ± 0.035 for FedAvg, and APlocal is 0.188 ± 0.054 versus 0.187 ± 0.058; these differences are far below one standard deviation. Similarly, in the i.i.d. real-data setting (Table 3) FedAvg exceeds DC on both APall and APlocal, which the text acknowledges but the Abstract's phrasing does not qualify. Please add paired significance tests across the 10 repeats (e.g., a paired Wilcoxon test) for each condition, and temper the superiority claims where the differences are within noise.","section":"Section 5.2, Table 4; Abstract"}],"minor_comments":[{"comment":"The FedProx proximal coefficient μ is never reported, even though it is a free parameter of a baseline used in the headline comparisons; please state the value used and, ideally, a small sensitivity check.","section":"Section 5.1"},{"comment":"The choice m̃_i = m − 1 means the PCA retains essentially all variance; this is a peculiar choice of 'dimensionality reduction' and directly weakens the privacy rationale, so it deserves justification and an ablation over smaller m̃_i.","section":"Section 4.2"},{"comment":"The pseudocode says the analyst 'obtains ... Y_k for all user i,' which suggests test data are shared with the analyst, contradicting Section 4.2, Step 4, where each organization applies f_i and G_i locally for anomaly detection; please clarify whether test projections are sent to the analyst.","section":"Algorithm, line 5"},{"comment":"The matrix C in Eq. (7) is described only as 'an invertible matrix,' which leaves the construction of the collaboration representation underdetermined; please specify the implementation choice used in the experiments for reproducibility.","section":"Section 3.3"},{"comment":"The caption of Table B.2 says 'The presentation style is consistent with that of Table B.2' (self-referential), and the title of Table B.4 begins 'Table B.3:'; please correct these cross-reference errors.","section":"Appendix B"},{"comment":"The 'single round of communication' phrasing actually involves three transmissions: the initial broadcast of X_anc, the clients' upload of X̃_i and X̃_i^anc, and the analyst's return of G_i and the trained autoencoder; please clarify the counting, e.g., one training round with no iterative aggregation.","section":"Abstract; Section 4.2"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern lands: the privacy claim is not merely unproven but appears false under the paper's own protocol, because the analyst's knowledge of the anchor plus the shared anchor projections provides the matched raw/projected pairs that Section 4.2 claims are unavailable. That said, I do not recommend rejection: the performance comparison is largely sound and the operational value of a one-round, connectivity-light collaboration method is real. The revision path is clear — add a formal privacy treatment or an honest reconstruction-attack evaluation and reframe the claims. I would also ask the editor to ensure the 'first application of DC analysis to unsupervised learning' claim is checked against the authors' own cited Imakura et al. (2021b) work on DC-based novelity detection. The concentration of self-citations in Section 2.2 is understandable given that the authors lead the DC line, but the novelty framing should be tightened."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know two things about this one: the empirical FL comparison is decent, and the privacy claim does not survive contact with the protocol. The authors assert that sharing PCA projections of journal entries makes raw data 'infeasible' to recover, but the DC protocol itself hands the analyst everything needed to invert the mapping. The analyst generates the anchor matrix, sends it to each organization, and receives back f_i(X_anc). Since f_i is affine (PCA centering plus projection), the analyst can solve a linear least-squares problem to recover the m-1 projection directions and the centering term. Every shared score then lies on a one-parameter line along the omitted principal component. For one-hot encoded accounting data, the discrete account structure resolves that ambiguity, giving near-exact recovery. The paper's own conclusion concedes that this 'warrants further investigation'—it is not a minor gap; it undermines the main practical selling point.\n\nWhat is genuinely new: applying DC analysis to unsupervised anomaly detection with an autoencoder on real journal entries from multiple organizations, with only one communication round. The experiments are reasonably careful—appropriate baselines (IA, CA, FedAvg, FedProx), repeated runs, standard deviations, both synthetic and real data, and i.i.d./non-i.i.d. splits. The non-i.i.d. real-data results do show DC beating FedAvg and FedProx on APall and APlocal (e.g., Table 4, lambda=4: 0.562 vs 0.402/0.424). That is a credible empirical finding, provided the privacy framing is stripped away.\n\nSoft spots beyond the privacy flaw: the 'first unsupervised DC application' novelty claim is weakened by the authors' own citation of Imakura et al. 2021b on collaborative novelty detection. There are no statistical significance tests, no code/data release, and only one real test set (Clinic A 2022). The 'no external network' phrasing also sits awkwardly with the required single round of communication—the data still leave the building once.\n\nOverall: the paper is worth sending to a serious referee, because the anomaly detection comparison is useful and the privacy failure needs to be documented in the literature. The right outcome is major revision: either add a formal privacy analysis (or a concrete attack), or drop the confidentiality claim and reposition the work as a low-communication collaborative learning method. If the authors can fix the privacy framing, the experimental contribution stands.\n\nRecommendation: send to peer review, expect heavy revision.","headline":"Useful experimental comparison, but the anchor protocol breaks the paper's own privacy guarantee; deserves major revision, not desk rejection.","tokens_in":18223,"tokens_out":2812,"would_cite":false,"duration_ms":26547,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single-round, non-model-sharing federated audit approach outperforms FedAvg and FedProx on non-i.i.d. journal entry data.","keywords":["anomaly detection","federated learning","data collaboration","journal entries","auditing","autoencoder","non-i.i.d. data","privacy-preserving"],"falsifier":"An attempted reconstruction attack on the shared intermediate representations: use the PCA projection matrix, or paired raw and projected samples, to invert the projected representations of held-out journal entries and check whether the one-hot account codes and transaction amounts are recovered; if a meaningful fraction of entries is reconstructed to the correct accounts and amounts, the paper's privacy claim is false.","tokens_in":17108,"feed_emoji":"🧾","tokens_out":5380,"duration_ms":50717,"temperature":0.7,"pith_summary":"This paper argues that anomaly detection for journal entries can be done collaboratively across audit firms without exposing the entries and without keeping the devices that hold them continuously online. The proposed scheme, based on data collaboration analysis, has each organization reduce its own data to low-dimensional projections, share only those projections plus projections of a common anchor matrix, and let an analyst build a collaboration representation used to train an autoencoder. On synthetic data and on real double-entry bookkeeping records from eight healthcare organizations, the method beats models trained on a single organization's data and, especially in non-i.i.d. settings that mimic real audits, outperforms FedAvg and FedProx on overall and local anomaly detection. If correct, this gives auditors a privacy-preserving way to pool knowledge across clients with one communication round and no raw-data exposure.","feed_headline":"Privacy-safe bookkeeping audit beats FedAvg and FedProx in one round","feed_subtitle":"Sharing only PCA projections of journal entries trains an autoencoder that detects more anomalies under non-i.i.d. audit data.","key_machinery":"The load-bearing object is the data-collaboration representation. Each organization applies its own PCA-based dimensionality reduction $f_i$ to its one-hot encoded, normalized journal entries, producing intermediate representations $\\tilde{X}_i = f_i(X_i)$, and applies the same map to a shared random anchor matrix. The analyst concatenates the anchor projections, takes a low-rank singular value decomposition, and computes a linear map $G_i$ via the Moore-Penrose pseudoinverse; applying $G_i$ to each organization's projections yields the collaboration representation $\\hat{X}$, on which the autoencoder is trained. This mechanism lets the analyst train a joint model without ever seeing raw entries, and it reduces the whole training process to one communication round; reconstruction error of the autoencoder then serves as the anomaly score.","core_discovery":"The paper's central claim is that the data collaboration (DC) framework, a non-model-sharing federated approach, can train an anomaly-detection autoencoder on journal entries distributed across organizations in a single communication round while keeping raw data local, and that this method achieves higher detection performance than model-sharing federated learning methods under non-i.i.d. conditions. In the real-data non-i.i.d. experiment with four participating organizations, DC reaches an average precision of 0.562 for all anomalies and 0.256 for local anomalies, versus 0.402 and 0.169 for FedAvg and 0.424 and 0.087 for FedProx.","pith_inferences":["The paper does not test the privacy guarantee: the claim that PCA projections are infeasible to invert on sparse one-hot accounting data is asserted, so a reconstruction attack should be run before the confidentiality advantage is relied on in deployment.","The persistent gap between DC and centralized analysis on local anomalies suggests that PCA discards information needed for subtle combined-feature anomalies; a projection method that better preserves sparse structure could close part of that gap.","The same single-round DC pipeline could be applied to other sensitive tabular audit data, such as expense reports or procurement records, wherever reconstruction error is a usable anomaly signal."],"forward_implications":["Audit firms could train joint anomaly detectors on journal entries from many clients while keeping raw data on disconnected systems, since only one outgoing transfer of projections is needed.","The single communication round removes the main connectivity and bandwidth burden of federated learning, making the method practical for clients that cannot stay online.","In non-i.i.d. environments, where each client has different account usage and data volumes, the method should remain more stable than FedAvg, whose performance degrades sharply.","Local anomalies, which are unusual combinations of accounts or amounts and carry high fraud risk, are detected better by the proposed method than by FedAvg and FedProx in the non-i.i.d. experiments, although a gap to centralized analysis remains."],"supporting_citations":[{"why":"Defines data collaboration analysis with intermediate representations and anchor-data linear mappings, the foundation the proposed method adapts.","marker":"(Imakura & Sakurai, 2020)"},{"why":"Introduced FedAvg, the model-sharing federated learning baseline the paper compares against.","marker":"(McMahan et al., 2017)"},{"why":"Prior federated anomaly detection for journal entries with FedAvg; supplies the baseline model and the anomaly-generation protocol.","marker":"(Schreyer et al., 2022)"},{"why":"Established autoencoder reconstruction error as an anomaly detection approach for journal entries, the detection model used here.","marker":"(Schreyer et al., 2017)"},{"why":"Introduced FedProx, the non-i.i.d. federated learning baseline used for comparison.","marker":"(Li et al., 2020)"},{"why":"Applied DC analysis to anomaly detection on synthetic and open datasets, motivating the application to distributed journal entries.","marker":"(Imakura et al., 2021b)"},{"why":"Provides PCA, the dimensionality reduction used to create the shared intermediate representations.","marker":"(Pearson, 1901)"}],"fun_headline_variants":["One-round federated audit beats FedAvg and FedProx without sharing models","Privacy-safe data collaboration outperforms model-sharing FL for audits","Single-round non-model FL detects more anomalies than FedAvg, FedProx","Federated audit with no model sharing beats FedAvg and FedProx in one round","Data collaboration beats model-sharing FL on private bookkeeping audit"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that sharing only PCA-projected versions of the journal entries makes it infeasible to reconstruct the original entries; the paper asserts this but provides no formal privacy bound, reconstruction attack, or leakage measurement, so if the projections can be inverted the confidentiality advantage of the method would collapse.","fun_headline_variants_meta":{"raw":{"variants":["One-round federated audit beats FedAvg and FedProx without sharing models","Privacy-safe data collaboration outperforms model-sharing FL for audits","Single-round non-model FL detects more anomalies than FedAvg, FedProx","Federated audit with no model sharing beats FedAvg and FedProx in one round","Data collaboration beats model-sharing FL on private bookkeeping audit"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000188,"raw_usage":{"total_tokens":1338,"prompt_tokens":956,"completion_tokens":382,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":572,"completion_tokens_details":{"reasoning_tokens":286}},"tokens_in":572,"tokens_out":382,"duration_ms":3967,"temperature":1.0,"reasoning_tokens":286,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T16:51:24.082748+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An attempted reconstruction attack on the shared intermediate representations: use the PCA projection matrix, or paired raw and projected samples, to invert the projected representations of held-out journal entries and check whether the one-hot account codes and transaction amounts are recovered; if a meaningful fraction of entries is reconstructed to the correct accounts and amounts, the paper's privacy claim is false.","supporting_citations":[],"review_version":1}